TraitFuzzer

TraitFuzzer is a tool for systematically validating Rust compilers. It introduces a validation approach based on the Trait-Type Constraint Graph (TTCG). TTCG captures relationships between types and traits and enables derivation of the Trait Constraint Space (TCS) for mutation. Guided by TTCG, TraitFuzzer rewrites ordinary seeds into trait-dense variants and performs both trait-constraint mutation and cross-feature mutation to drive compilers into deeper trait-solving logic. In practice, TraitFuzzer has uncovered 45 confirmed compiler bugs, including 36 in rustc and 9 in gccrs, with 12 already fixed. It also outperforms existing baselines in bug-finding ability and coverage.

🚀 Quick Start

The checked-in trait-dense corpus lets you start fuzzing without generating seeds first. Run the first command from the repository root; continue from inside TraitFuzzer/.

1. Install prerequisites

cd TraitFuzzer
python3 -m pip install requests
rustup toolchain install stable nightly

Build and test the Rust AST mutation engine once:

cargo test --manifest-path SeedMutation/trait_constraint_mutation/ast_engine/Cargo.toml

2. Run with the included corpus

The default configuration enables both trait-constraint and cross-feature mutation. Configure the llm section in config.json using LLM configuration. To run without an LLM, set fuzzer.mutation_mode to "trait-constraint" in config.json.

./start.sh

Choose start in the menu. Seeds are read from SeedGeneration/trait_dense_seeds/; results and logs are written to results/ and logs/. Choose kill in the same menu to stop a run.

3. Import additional rustc UI tests (optional)

Clone the Rust repository, then import standalone UI tests with the safe, non-overwriting importer:

git clone --depth 1 https://github.com/rust-lang/rust.git /tmp/rust
python3 utils/corpus/import_rustc_ui.py \
  --src /tmp/rust \
  --dst seeds/rust-official/ui

See Seed import for supported source layouts and duplicate handling.

4. Generate new seeds with an LLM (optional)

Configure the llm section in SeedGeneration/config.json. You can use Ollama to deploy a local model or connect to an OpenAI-compatible API by setting the provider, API address, model, and API key environment variable. See LLM configuration for both options.

Generate a seed with the configured backend:

python3 SeedGeneration/run_seed.py \
  --input seeds/example.rs \
  --output results/generated_seed.rs

🐞 Detected Bugs (rustc)

Compiler	Type	Bug Link	Status
rustc	ICE	rust-lang/rust#151069	confirmed
rustc	ICE	rust-lang/rust#151477	fixed
rustc	ICE	rust-lang/rust#151894	confirmed
rustc	ICE	rust-lang/rust#151964	confirmed
rustc	ICE	rust-lang/rust#152295	confirmed
rustc	ICE	rust-lang/rust#152405	confirmed
rustc	ICE	rust-lang/rust#153195	duplicate
rustc	ICE	rust-lang/rust#153241	confirmed
rustc	ICE	rust-lang/rust#150751	duplicate
rustc	ICE	rust-lang/rust#150753	duplicate
rustc	ICE	rust-lang/rust#150770	duplicate
rustc	ICE	rust-lang/rust#150854	duplicate
rustc	ICE	rust-lang/rust#151579	fixed
rustc	ICE	rust-lang/rust#154568	confirmed
rustc	ICE	rust-lang/rust#154533	confirmed
rustc	ICE	rust-lang/rust#151631	fixed
rustc	ICE	rust-lang/rust#153163	fixed
rustc	ICE	rust-lang/rust#153842	fixed
rustc	ICE	rust-lang/rust#152205	fixed
rustc	ICE	rust-lang/rust#154403	fixed
rustc	ICE	rust-lang/rust#154073	duplicate
rustc	ICE	rust-lang/rust#153912	fixed
rustc	ICE	rust-lang/rust#150954	duplicate
rustc	ICE	rust-lang/rust#154367	fixed
rustc	Hang	rust-lang/rust#150583	confirmed
rustc	Hang	rust-lang/rust#150794	confirmed
rustc	Hang	rust-lang/rust#150858	confirmed
rustc	Hang	rust-lang/rust#150989	confirmed
rustc	Hang	rust-lang/rust#151503	confirmed
rustc	Hang	rust-lang/rust#151599	confirmed
rustc	Hang	rust-lang/rust#151671	confirmed
rustc	Hang	rust-lang/rust#151723	confirmed
rustc	Hang	rust-lang/rust#150532	duplicate
rustc	Hang	rust-lang/rust#151632	confirmed
rustc	Hang	rust-lang/rust#151961	confirmed
rustc	Hang	rust-lang/rust#152169	confirmed
rustc	Hang	rust-lang/rust#151636	confirmed

🐞 Detected Bugs (gccrs)

Compiler	Type	Bug Link	Status
gccrs	ICE	Rust-GCC/gccrs#4469	confirmed
gccrs	ICE	Rust-GCC/gccrs#4470	confirmed
gccrs	ICE	Rust-GCC/gccrs#4471	fixed
gccrs	ICE	Rust-GCC/gccrs#4472	confirmed
gccrs	ICE	Rust-GCC/gccrs#4473	confirmed
gccrs	ICE	Rust-GCC/gccrs#4481	fixed
gccrs	ICE	Rust-GCC/gccrs#4486	fixed
gccrs	ICE	Rust-GCC/gccrs#4496	confirmed
gccrs	Hang	Rust-GCC/gccrs#4493	confirmed

📄 Publication

TraitFuzzer is presented in the following paper:

Validating Rust Compilers with Trait-Type Constraint Graph
Xin Lai, Ming Wen, Xiaofei Liao, and Hai Jin
Proceedings of the ACM SIGOPS 32nd Symposium on Operating Systems Principles (SOSP '26), 2026.

Paper (DOI)

📚 Citation

If you use TraitFuzzer in your research, please cite our paper:

@inproceedings{lai2026traitfuzzer,
  author    = {Lai, Xin and Wen, Ming and Liao, Xiaofei and Jin, Hai},
  title     = {Validating {Rust} Compilers with {Trait-Type Constraint Graph}},
  booktitle = {Proceedings of the ACM SIGOPS 32nd Symposium on Operating Systems Principles},
  year      = {2026},
  publisher = {ACM},
  doi       = {10.1145/3830418.3843907},
  url       = {https://doi.org/10.1145/3830418.3843907}
}